Skip to content

Commit 8ca82d4

Browse files
YuriiMotovYuriiMotov
committed
Merge remote-tracking branch 'upstream/main' into daniil-berg_main
2 parents 53809d1 + c14beb4 commit 8ca82d4

300 files changed

Lines changed: 3166 additions & 9985 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,25 @@ updates:
55
directory: "/"
66
schedule:
77
interval: "daily"
8+
cooldown:
9+
default-days: 7
810
commit-message:
911
prefix: ⬆
1012
# Python
1113
- package-ecosystem: "uv"
1214
directory: "/"
1315
schedule:
1416
interval: "daily"
17+
cooldown:
18+
default-days: 7
19+
commit-message:
20+
prefix: ⬆
21+
# pre-commit
22+
- package-ecosystem: "pre-commit"
23+
directory: "/"
24+
schedule:
25+
interval: "daily"
26+
cooldown:
27+
default-days: 7
1528
commit-message:
1629
prefix: ⬆

‎.github/labeler.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ internal:
1616
- scripts/**
1717
- .gitignore
1818
- .pre-commit-config.yaml
19-
- pdm_build.py
2019
- requirements*.txt
20+
- uv.lock
2121
- all-globs-to-all-files:
2222
- '!docs/**'
2323
- '!sqlmodel/**'

‎.github/workflows/add-to-project.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
name: Add to Project
22

33
on:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
issues:
66
types:
77
- opened
88
- reopened
99

10+
permissions: {}
11+
1012
jobs:
1113
add-to-project:
1214
name: Add to project
1315
runs-on: ubuntu-latest
16+
timeout-minutes: 5
1417
steps:
15-
- uses: actions/add-to-project@v1.0.2
18+
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
1619
with:
1720
project-url: https://github.com/orgs/fastapi/projects/2
18-
github-token: ${{ secrets.PROJECTS_TOKEN }}
21+
github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

‎.github/workflows/build-docs.yml‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,24 @@ on:
88
- opened
99
- synchronize
1010

11+
permissions: {}
12+
1113
jobs:
1214
changes:
1315
runs-on: ubuntu-latest
1416
# Required permissions
1517
permissions:
1618
pull-requests: read
19+
timeout-minutes: 5
1720
# Set job outputs to values from filter step
1821
outputs:
1922
docs: ${{ steps.filter.outputs.docs }}
2023
steps:
21-
- uses: actions/checkout@v6
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2225
# For pull requests it's not necessary to checkout the code but for the main branch it is
23-
- uses: dorny/paths-filter@v3
26+
with:
27+
persist-credentials: false
28+
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
2429
id: filter
2530
with:
2631
filters: |
@@ -41,34 +46,38 @@ jobs:
4146
- changes
4247
if: ${{ needs.changes.outputs.docs == 'true' }}
4348
runs-on: ubuntu-latest
49+
timeout-minutes: 5
4450
steps:
4551
- name: Dump GitHub context
4652
env:
4753
GITHUB_CONTEXT: ${{ toJson(github) }}
4854
run: echo "$GITHUB_CONTEXT"
49-
- uses: actions/checkout@v6
55+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
56+
with:
57+
persist-credentials: false
5058
- name: Set up Python
51-
uses: actions/setup-python@v6
59+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5260
with:
5361
python-version-file: ".python-version"
5462
- name: Setup uv
55-
uses: astral-sh/setup-uv@v7
63+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
5664
with:
65+
# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
66+
# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
67+
version: "0.11.4"
5768
enable-cache: true
5869
cache-dependency-glob: |
5970
pyproject.toml
6071
uv.lock
6172
- name: Install docs extras
6273
run: uv sync --locked --no-dev --group docs
63-
- uses: actions/cache@v5
74+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
6475
with:
6576
key: mkdocs-cards-${{ github.ref }}
6677
path: .cache
67-
- name: Verify README
68-
run: uv run ./scripts/docs.py verify-readme
6978
- name: Build Docs
7079
run: uv run ./scripts/docs.py build
71-
- uses: actions/upload-artifact@v6
80+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
7281
with:
7382
name: docs-site
7483
path: ./site/**
@@ -80,9 +89,10 @@ jobs:
8089
needs:
8190
- build-docs
8291
runs-on: ubuntu-latest
92+
timeout-minutes: 5
8393
steps:
8494
- name: Decide whether the needed jobs succeeded or failed
85-
uses: re-actors/alls-green@release/v1
95+
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
8696
with:
8797
jobs: ${{ toJSON(needs) }}
8898
allowed-skips: build-docs

‎.github/workflows/deploy-docs.yml‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,41 @@
11
name: Deploy Docs
22
on:
3-
workflow_run:
3+
workflow_run: # zizmor: ignore[dangerous-triggers]
44
workflows:
55
- Build Docs
66
types:
77
- completed
88

9-
permissions:
10-
deployments: write
11-
issues: write
12-
pull-requests: write
13-
statuses: write
9+
permissions: {}
1410

1511
jobs:
1612
deploy-docs:
1713
runs-on: ubuntu-latest
14+
permissions:
15+
deployments: write
16+
issues: write
17+
pull-requests: write
18+
statuses: write
19+
timeout-minutes: 5
1820
steps:
1921
- name: Dump GitHub context
2022
env:
2123
GITHUB_CONTEXT: ${{ toJson(github) }}
2224
run: echo "$GITHUB_CONTEXT"
23-
- uses: actions/checkout@v6
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
with:
27+
persist-credentials: false
2428
- name: Set up Python
25-
uses: actions/setup-python@v6
29+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2630
with:
2731
python-version-file: ".python-version"
2832
- name: Setup uv
29-
uses: astral-sh/setup-uv@v7
33+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
3034
with:
31-
enable-cache: true
32-
cache-dependency-glob: |
33-
pyproject.toml
34-
uv.lock
35+
# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
36+
# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
37+
version: "0.11.4"
38+
enable-cache: false
3539
- name: Install GitHub Actions dependencies
3640
run: uv sync --locked --no-dev --group github-actions
3741
- name: Deploy Docs Status Pending
@@ -45,7 +49,7 @@ jobs:
4549
run: |
4650
rm -rf ./site
4751
mkdir ./site
48-
- uses: actions/download-artifact@v7
52+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4953
with:
5054
path: ./site/
5155
pattern: docs-site
@@ -59,10 +63,10 @@ jobs:
5963
env:
6064
PROJECT_NAME: sqlmodel
6165
BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
62-
uses: cloudflare/wrangler-action@v3
66+
uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
6367
with:
64-
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
65-
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
68+
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
69+
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
6670
command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
6771
- name: Deploy Docs Status Error
6872
if: failure()

‎.github/workflows/detect-conflicts.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
name: "Conflict detector"
22
on:
33
push:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
types: [synchronize]
66

7+
permissions: {}
8+
79
jobs:
810
main:
911
permissions:
1012
contents: read
1113
pull-requests: write
1214
runs-on: ubuntu-latest
15+
timeout-minutes: 5
1316
steps:
1417
- name: Check if PRs have merge conflicts
15-
uses: eps1lon/actions-label-merge-conflict@v3
18+
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
1619
with:
1720
dirtyLabel: "conflicts"
1821
repoToken: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/guard-dependencies.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Guard Dependencies
2+
3+
on:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers] -- This workflow only reads context.payload metadata, never checks out PR code
5+
branches: [main]
6+
paths:
7+
- pyproject.toml
8+
- uv.lock
9+
10+
permissions:
11+
contents: read
12+
issues: write
13+
pull-requests: write
14+
15+
jobs:
16+
check-author:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Check if author is org member or allowed bot
20+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
21+
with:
22+
script: |
23+
const pr = context.payload.pull_request;
24+
const author = pr.user.login;
25+
const assoc = pr.author_association;
26+
27+
const botAllowlist = new Set(['dependabot[bot]']);
28+
const orgAuthorAssociations = new Set(['MEMBER', 'OWNER']);
29+
30+
const allowed =
31+
botAllowlist.has(author) ||
32+
(assoc != null && orgAuthorAssociations.has(assoc));
33+
34+
if (!allowed) {
35+
await github.rest.issues.createComment({
36+
owner: context.repo.owner,
37+
repo: context.repo.repo,
38+
issue_number: context.payload.pull_request.number,
39+
body: `This PR modifies dependency files (\`pyproject.toml\` or \`uv.lock\`), which is restricted to members of the **${context.repo.owner}** organization on GitHub.\n\nIf you need a dependency change, please [open a discussion](https://github.com/${context.repo.owner}/${context.repo.repo}/discussions/new) describing what you need and why.\n\nClosing this PR automatically.`
40+
});
41+
42+
await github.rest.pulls.update({
43+
owner: context.repo.owner,
44+
repo: context.repo.repo,
45+
pull_number: context.payload.pull_request.number,
46+
state: 'closed'
47+
});
48+
49+
core.setFailed('Dependency changes are restricted to organization members.');
50+
} else {
51+
console.log(`Author ${author} (author_association=${assoc}) is allowed to make dependency changes.`);
52+
}

‎.github/workflows/issue-manager.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,27 @@ on:
99
issues:
1010
types:
1111
- labeled
12-
pull_request_target:
12+
pull_request_target: # zizmor: ignore[dangerous-triggers]
1313
types:
1414
- labeled
1515
workflow_dispatch:
1616

17-
permissions:
18-
issues: write
19-
pull-requests: write
17+
permissions: {}
2018

2119
jobs:
2220
issue-manager:
2321
if: github.repository_owner == 'fastapi'
2422
runs-on: ubuntu-latest
23+
permissions:
24+
issues: write
25+
pull-requests: write
26+
timeout-minutes: 5
2527
steps:
2628
- name: Dump GitHub context
2729
env:
2830
GITHUB_CONTEXT: ${{ toJson(github) }}
2931
run: echo "$GITHUB_CONTEXT"
30-
- uses: tiangolo/issue-manager@0.6.0
32+
- uses: tiangolo/issue-manager@2fb3484ec9279485df8659e8ec73de262431737d # 0.6.0
3133
with:
3234
token: ${{ secrets.GITHUB_TOKEN }}
3335
config: >
@@ -41,11 +43,15 @@ jobs:
4143
"message": "As this PR has been waiting for the original user for a while but seems to be inactive, it's now going to be closed. But if there's anyone interested, feel free to create a new PR.",
4244
"reminder": {
4345
"before": "P3D",
44-
"message": "Heads-up: this will be closed in 3 days unless there’s new activity."
46+
"message": "Heads-up: this will be closed in 3 days unless there's new activity."
4547
}
4648
},
4749
"invalid": {
4850
"delay": 0,
4951
"message": "This was marked as invalid and will be closed now. If this is an error, please provide additional details."
52+
},
53+
"maybe-ai": {
54+
"delay": 0,
55+
"message": "This was marked as potentially AI generated and will be closed now. If this is an error, please provide additional details, make sure to read the docs about contributing and AI."
5056
}
5157
}

‎.github/workflows/labeler.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Labels
22
on:
3-
pull_request_target:
3+
pull_request_target: # zizmor: ignore[dangerous-triggers]
44
types:
55
- opened
66
- synchronize
@@ -9,14 +9,17 @@ on:
99
- labeled
1010
- unlabeled
1111

12+
permissions: {}
13+
1214
jobs:
1315
labeler:
1416
permissions:
1517
contents: read
1618
pull-requests: write
1719
runs-on: ubuntu-latest
20+
timeout-minutes: 5
1821
steps:
19-
- uses: actions/labeler@v6
22+
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
2023
if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
2124
- run: echo "Done adding labels"
2225
# Run this after labeler applied labels
@@ -26,8 +29,9 @@ jobs:
2629
permissions:
2730
pull-requests: read
2831
runs-on: ubuntu-latest
32+
timeout-minutes: 5
2933
steps:
30-
- uses: docker://agilepathway/pull-request-label-checker:latest
34+
- uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
3135
with:
3236
one_of: breaking,security,feature,bug,refactor,upgrade,docs,lang-all,internal
3337
repo_token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)